Sena! No.: 10/798,070 



1 

2 LISTJNO OF THE CLAIMS 

3 

4 

5 What is claimed, is: 
6 

7 1 . (currently amended) A method of monitoring events in a computer network, the method 

8 comprising: 
9 

10 said computer network triggering said events, each event being provided with attribute values 

1 1 allocated to a given set of attributes of said each event, 
12 

1 3 simultaneously monitoring various event attributes from said given set of attributes versus the 

14 arrival time of said each event 4he ev e nts , 
15 

1 6 providing an event display with a cross plot having x and y coordinate axes, the x-axis 

1 7 presenting a time period and the y-axis presenting an attribute value range, and visualizing data 

1 8 along said x and y coordinate axes, said axes being attribute axes, 
19 

20 determining a primary attribute of said i he ev e nts selected from the given set of 

21 attributes to be presented with its attribute values on the y-axis of the cross plot, 
22 

23 allocating a first display label to the events indicating the attribute values of the primary 

24 attribute, providing a pattern algorithm to detect whether an arrived ev ent is part of the given 

25 pattern on the basis of a comparison of the attributes allocated to the given pattern and of the 

26 attributes assigned to the arrived event, providing a mapping algorithm to map any attribute 

27 value of an attribute selected from the given set of attributes onto the y-axi s of the cross plot, 
28 

29 allocating a second display label to 1 i\ ens the ' events indicating the attribute values of 

30 the attributes being uncovered as part of the given pattern, 
31 
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1 plotting all the events that arrived within the time period and including an attribute value 

2 allocated to the primary attribute into the cross plot with the first display label indicating the 

3 primary attribute, the position of the first display label of said each event in the cross plot being 

4 determined on the ba: s the ttribute \ alue of die priman attribute of the event and its arrival 

5 time, 
6 

7 plotting the all events that arrived within the time period and being detected by means of the 

8 pattern algorithm as part of the given pattern into the cross plot with the second display label 

9 indicating the given pattern, the position of the second display label of said each event in the 

1 0 cross plot being determined by the mapping algorithm on the basi s of the attribute value of the 

1 1 attribute of the event being uncovered as part of the given pattern and its arrival time,~aml 
12 

1.3 viewing a secondary attribute of said each event together with the primary attribute on said 

14 display; and. 

15 

16 autom atically generating a large variet y of visualizations along o ther attribute axes, and 

17 identifying correlations by superimposing and cross-referencing these visualizations, 
18 

1 9 2. (original) The method according to claim 1 , further comprising: 
20 

2 1 recording the attribute values and the arrival time of a new event, determining on the basis of the 

22 recorded attribute values of event whether or not the newly arrived event includes an attribute 

23 value of the priman-' attribute, and if the newly arrived event includes the attribute value for the 

24 primary attribute shifting the x-axis of the cross plot so that the time period being presented on 

25 the x-axis covers the arrival time of the event, and 
26 

27 plotting the event arrived within the shifted time period into the cross plot with the first display 

28 label indicating the primary attribute. 
29 

30 3. (original) The method according to claim 2 comprising the further steps of: 
31 
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1 determining on the basis of the recorded attribute values of event whether or not the newly 

2 arrived event is part of the given pattern on the basis of a comparison of the attributes allocated 

3 to the given pattern and of the attributes assigned to the arrived event, 
4 

5 if the newly arrived event includes an attribute value of the given pattern adding the event to the 

6 previous events being detected as part of the given pattern, and 
7 

8 redrawing all the events being associated with given pattern in the cross plot. 

9 

1 0 4. (currently amended) The method according to claim 3, further comprising; 
11 

12 if the newly arrived event does not include an attribute value of the given pattern, determining on 

13 the basis of the recorded attribute values of all previous arrived events by means of the pattern 

14 algorithm whether or not the newly arrived event is part of a new pattern on the basis of a 

15 comparison of the attributes allocated to the new pattern and of the attributes assigned to the 

16 arrived events; 
1.7 

1 8 if the newly arrived event forms together with previous recorded events the new pattern, 

1 9 allocating a third display label to the e\ ents indicating the attribute values of the attributes being 

20 uncovered as part of the new pattern; and 
21 

22 plotting the all events being detected by means of the pattern algorithm as pan of the new pattern 

23 into the cross plot with the third display label indicating the new pattern, the position of the third 

24 displ ay label of said each event in the cross plot being determined by the mapping algorithm on 

25 the basts of the attribute value of the attribute of the event being uncovered as part of the new 

26 patten) and its arrival time. 
27 

28 5 (currently amended) The method according to claim 1 , further comprising: 
29 

30 removing all the events including an attribute value allocated to the primary attribute from the 

3 1 cross plot, if a primary attribute to be presented with its attribute values on the y-axis of the cross 
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1 plot is changed, allocating a fourth display label to the events indicating the attribute values of 

2 the new primary attribute, and 
3 

4 plotting all the events arrived within the time period and including an attribute value allocated to 

5 the new primary attribute into the cross piot with the fourth display label indicating the new 

6 primary attribute, the position of the fourth display label of said each event in the cross plot 

7 being determined on the basis of the attribute value of the primary attribute of the event and its 

8 arrival time. 
9 

10 6. (original) The method according to claim 1 comprising the further steps of plotting all 

1 1 attribute values recorded for an event with the respective display label into the cross plot if the 

12 event is selected by an operator, and displaying textual information associated with the selected 

13 event on the event display. 
14 

15 7. (original) The method according to claim I, wherein the pattern algorithm is suitable to 



16 perform muiti -attribute pattern recognition. 

1.7 

18 8, (original) The method according to claim 1, wherein each display label includes a specific 

1 9 color and/or a specific mark layout. 
20 

21 9. (original) The method according to claim 1, wherein all events being uncovered as part of the 

22 pattern are clustered by the corresponding display label. 

23 

24 10. (currently amended) A method according to claim 1, further comprising employing a 

25 c< m oft triable p u n i ibiec imjxi er medi a ee i« i« n pri ,u 

26 program code to can t Ik ng eaey out the steps of triggering, monitoring, 

27 pio\uh i I i i first display lab 1 locating a second display label 

28 plotting events including an attribute value, plotting events detected,, viewing, and 

29 automatically generating, tite metl>od-of-eMm-4-; when the program code is running on a 

30 computer. 
31 
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1 11. (currently amended) A computer program M.o.!^nS^T.M^MiM^iM containing a 

2 program code to carry out-the all steps of the method of claim 1, sai d program code being 

3 stored on data carrier. 
4 

5 1 2. (original) An event visualization device for monitoring events in a computer network, the 

6 device comprising means to perform the all, steps of the method as claimed in claim 1 . 

7 

8 13. (currently amended) An article of manufacture comprising a computer usable readable. 

9 medium having computer readable program code means embodied therein for causing 

10 monitoring of events in a computer network, the computer readable program code means in said 

1 1 article of manufacture comprising computer readable program code means for causing a 

1 2 computer to effect -the all steps of claim 1 . 
13 

14 14. (currently amended) A program storage device being a computer readable medium by-- 

15 maehine, tangibly embodying a program of instructions executable by the machine to perform 

1.6 method steps for monitoring events in a computer network, said method steps comprising the 

1.7 steps of said computer network triggering said events, each event being provided with attribute 

1.8 values allocated to a given set of attributes of said each event, 

1.9 simultaneously monitoring vanous event attributes from sa;d gj < en set ot attributes versus the 
20 arri val time of said each event -the events, 

21 

22 providing an event display with a cross plot having x and y coordinate axes, the x-axis 

23 presenting a time period and the y-a.xis presenting an attribute value range, and visualizing data 

24 along said x and y coordinate axes, said axes being attribute axes, 
25 

26 determining a primary attri bute of said each event the events sel ected from the given set of 

27 attributes to be presented with its attribute values on the y-axis of the cross plot, 
28 

29 allocating a first display label to the events indicating the attribute values of the primary 

30 attribute, providing a pattern algorithm to detect whether an arrived event is pan of the given 

3 1 pattern on the basis of a. comparison of the attributes allocated to the given pattern and of the 
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1 attributes assigned to the arrived event, providing a mapping algorithm to map any attribute 

2 value of an attribute selected from the given set of attributes onto the y-axis of the cross plot, 
3 

4 allocating a second display label to s < v> em the-evea ndi< i 1 ntribute values of 

5 the attributes being uncovered as part of the given pattern, 
6 

7 plotting all -the events that arrived within the time period and including an attribute value 

8 allocated to the primary attribute into the cross plot with the first display label indicating the 

9 primary attribute, the position of the first display label of said each event in the cross plot being 

1 0 determined on the basis of the attribute value of the primary attribute of the event and its arrival 

1 1 time, 
12 

13 plotting the all events thai arrived within the time period and being detected by means of the 

14 pattern algorithm as part of the given pattern into the cross plot with the second display label 

15 indicating the gi ven pattern, the position of the second display label of said each event in the 

16 cross plot being determined by the mapping algorithm on the basis of the attribute value of the 

17 attribute of the event being uncovered as part of the given pattern and its arrival time 5 -aad 
18 

19 viewing a secondary attribute of said each event together with the primary attribute, on said 

20 display ; and 
21 

22 automatically ..generatbig a large yariery of 

23 identifying correlations by superimposing and cross-referencing these visualizations, 
24 

25 15, (currently amended) A computer program product comprising a computer us a b le read » je 

26 medium having computer readable program code means embodied therein for causing the event 

27 visualization device, the computer readable program code means in said computer program 

28 product comprising computer readable program code means for causing a computer to effect the 

29 all functions of claim 12, 
30 

3 1 16. (previously presented) The method according to claim 1, further comprising: 
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1 

2 recording the attribute values and the arrival time of a new event, determining on the basis of the 

3 recorded attribute values of event whether or not the newly arrived event includes an attribute 

4 value of the primary attribute, and if the newly arrived event includes the attribute value for the 

5 primary attribute shifti ng the x-axis of the cross plot so that the time period being presented on 

6 the x-axis covers the arrival time of the event, 
7 

8 plotting the event arrived within the shifted time period into the cross plot with the first display 

9 label indicating the primaiy attribute: 
10 

1 1 determining on the basis of the recorded attribute values of event whether or not the newly 

12 arrived event is part of the given pattern on the basis of a comparison of the attributes allocated 

13 to the given pattern and of the attributes assigned to the ar rived event, 
14 

15 if the newly arrived event includes an attribute value of the given pattern adding the event to the 

16 previous events being detected as part of the given pattern; 

1.7 

18 redrawing all the events being associated with given pattern in the cross plot; 
19 

20 if the newly arrived event does not include an attribute value of the given pattern, determining on 

21 the basis of the recorded attribute values of all previous arrived events by means of the pattern 

22 algorithm whether or not the newly arrived event is part of a new pattern on the basis of a 

23 comparison of the attributes allocated to the new pattern and of the attributes assigned to the 

24 arrived events; 
25 

26 if the newly arrived event forms together with previous recorded events the new pattern, 

27 allocating a third display label to the events indicating the attribute values of the attributes being 

28 uncovered as part of the new pattern; and 
29 

30 plotting the ail events being detected by means of the pattern algorithm as part of the new pattern 

3 1 into the cross plot with the third display label indicating die new pattern, the position of the third 
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1 display label of each event in the cross plot being determined by the mapping algorithm on the 

2 basis of the attribute value of the attribute of the event being uncovered as part of the new pattern 

3 and its arrival time; 
4 

5 17. (previously presented) The method according to claim 16., further comprising: 
6 

7 removing ail the events including an attribute value allocated to the primary attribute from the 

8 cross plot, if a primary attribute to be presented with its attribute values on the y-axis of the cross 

9 plot is changed, allocating a fourth display label to the events indicating the attribute values of 
10 the new primary attribute, and 

11 

12 plotting ail the events arrived within the time period and including an attribute value allocated to 

13 the new primary attribute into the cross plot with the fourth display label indicating the new 

14 primary attribute, the position of the fourth display label of each event in the cross plot being 

15 determined on the basis of the attribute value of the primary attribute of the event and its arrival 

16 time. 
17 

1 8 18. (previously presented) The event visualization device for monitoring events in a computer 

.1 9 network, according to claim 1 2, further comprising: 

20 

21 means for recording the attribute values and the arrival time of a new event, means for 

22 determining on the basis of the recorded attribute values of event whether or not the newly 

23 arrived event includes an attribute value of the primary attribute, and if the newly arrived event 

24 includes the attribute value for the primary attribute shifting the x-axis of the cross plot so thai 

25 the time period being presented on the x-axis covers the arrival time of the event, 
26 

27 means for plotting the event arrived within the shifted time period into the cross plot with the 

28 first display label indicating the primary attribute; 
29 
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1 means for determining on the basis of the recorded attribute values of event whether or not the 

2 newly arrived event is part of the given pattern on the basis of a comparison of the attributes 

3 allocated to the given pattern and of the attributes assigned to the arrived event; 
4 

5 means for adding for if the newly arrived event includes an attribute value of the given pattern 

6 adding the event to the previous events being detected as pari of the given pattern; 
7 

8 means for redrawing all the events being associated with given pattern in the cross plot; 
9 

1 0 means for determining if the newly arrived event does not include an attribute value of the given 

1 1 pattern, means for determining on the basis of the recorded attribute values of all previous 

12 arrived events by means of the pattern algorithm whether or not the newly arrived event is part 
1.3 of a new pattern on the basis of a comparison of the attributes allocated to the new pattern and of 
14 the attributes assigned to the arrived events; 

15 

16 means for allocating if the newly arrived event forms together with previous recorded events the 

17 new pattern, allocating a third display label to the events indicating the attribute values of the 

18 attributes being uncovered as part of the new pattern; and 
19 

20 means for plotting the all events being detected by means of the pattern algorithm as part of the 

21 .new pattern into the cross plot with the third display label indicating the new pattern, the position 

22 of the third display label of each event in the cross plot being determined by the mapping 

23 algorithm on the basis of the attribute value of the attribute of the event being uncovered as part 

24 of the new pattern and its arrival time; 
25 

26 19. (previously presented) The event visualization device for monitoring events in a computer 

27 network, according to claim 1 8, further comprising: 
28 

29 means for removing all the events including an attribute value allocated to the primary attribute 

30 from the cross plot if a primary attribute to be presented with its attribute values on the y-axis of 
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1 the cross plot is changed, allocating a fourth display label to the events indicating the attribute 

2 values of the new primary attribute, and 
3 

4 means for plotting all the events arrived within the time period and including an attribute value 

5 allocated to the new primary attribute into the cross plot with the fourth display label i ndicating 

6 the new primary attribute, the position of the fourth display label of each event in the cross plot 

7 being determined on the basis of the attribute value of the primary attribute of the event and its 

8 arrival time. 
9 

1 0 20. (currently amended) An article of manufacture comprising apparatus for monitoring events in 

1 1 a computer network, the m et hod apparatus comprising: 
12 

13 said computer network having means for triggering said events, each event being provided with 

14 attribute values allocated to a given set of attributes of said each event, 
15 

16 means for simultaneously monitoring various event attributes from said given v i 

1 7 versus the arri val time of said each event -fee events, 
18 

1 9 means for providing an event display with a cross plot having x and y coordinate axes, the x-axis 

20 presenting a time period and the y-axis presenting an attribute value range, and visualizing data 

21 along said x and y coordinate axes, said axes being attribute axes, 
22 

23 means for determining a primary attribute of said each event the e v e nts selected from the given 

24 set of attributes to be presented with its attribute values on the y-axis of the cross plot, 
25 

26 means for allocating a first display label to the events indicating the attribute values of the 

27 primary attribute, pun iding « > thm to detect whether an arrived event is part of the 

28 given pattern on the basis of a comparison of the attributes allocated to the given pattern and of 

29 the attributes assigned to the arrived event, providing a mapping algorithm to map any attribute 

30 value of an attribute selected from the given set of attributes onto the y-axis of the cross plot, 
31 
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1 means for allocating a second display label to ^id.each.eyent -the-evmts indicating the attribute 

2 values of the attributes being uncovered as part of the given pattern, 

3 

4 means for plotting all-the events that arrived within the time period and including an attribute 

5 value allocated to the primary attribute into the cross plot with the first display label indicating 

6 the primary attribute, the position of the first display label of said each event m the cross plot 

7 being determined on the basis of the attribute value of the primary attribute of the event and its 

8 arrival time, 
9 

1 0 means for plotting the all events that arrived within the time period and being detected by means 

1 1 of the pattern algorithm as part of the given pattern into the cross plot with the second display 

12 label indicating the given pattern, the position of the second display label of said. each event in 
1.3 the cross plot being determined by the mappi ng algorithm on the basis of the attribute value of 
14 the attribute of the event being uncovered as part of the given pattern and its arrival time, and 
15 

16 means for viewing a secondary attribute of said each event together with the primary attribute on 

1.7 said display ; and 

18 

19 meansfoi automaiiMH generMmg ajinge /arietj pj m v u-i :/;n:= >rs J , -hy , •!!:.;! aMbuteaxes 

20 and identifying correlations by superimposing and cross-referencing these visualizations. 
21 
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